Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/05/2024, 23:25

General

  • Target

    2024-05-30_598be0f73441e6dcaf8013aa69d1fe23_bkransomware.exe

  • Size

    1.3MB

  • MD5

    598be0f73441e6dcaf8013aa69d1fe23

  • SHA1

    4d534f8e44a76b7254ed00364435361e75eb481d

  • SHA256

    5816a3567cd7a94e38c78ff399ee75e7a00d7732a80e5926e82f15d9f11e8b03

  • SHA512

    8114b6d541ccbad9a860b4a4490f707f37906aea97fb2cb2eda4a9dbda3a467a276a9970d84a1c44e04498bedb1ee13983a98cefdf5b4a99d4b23de0d44fd146

  • SSDEEP

    12288:6tOw6BaLUVpyNj3C/Ei9OQSt6uk3zO61zOQJjN6atJ6bVgwtZJz:U6B+UMj3C/Uvw3B8atQVpZJ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-30_598be0f73441e6dcaf8013aa69d1fe23_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-30_598be0f73441e6dcaf8013aa69d1fe23_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3548
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:2368
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3444
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4584
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:540
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3564
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4672
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:468
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:1296
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:3896
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:4520
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:4924
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:2244
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2748
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:2348
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4500
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:464
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:4724
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:396
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2772
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:4660
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4708
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1672
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:208
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2672
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:2552
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
          2⤵
          • Modifies data under HKEY_USERS
          PID:3812

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

              Filesize

              2.1MB

              MD5

              73469136dd6e1658263139f491f25f87

              SHA1

              89036f1d71fa5bc4cefffef18fe026403ff703c0

              SHA256

              ca1311816b4ccbc4bf406ebb662d65f4aea19f0e176fee2e2b48f6cce9c1e75a

              SHA512

              cba46b58c59913be905ce15176ab9ec919050dcddb2a465e70a2d2b1585f372a0263fbe0ab7895fd49327ffc7718a9e63cbf08f9ebad33d427c96d1657f4185d

            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

              Filesize

              1.4MB

              MD5

              7db2a5c629267dde18093d076c9822ad

              SHA1

              4d8479616ad469834d2b75ba13b2e68f28de6d67

              SHA256

              ec89d15076f234df862114a5c3674a5f797628b14d1e63060321d6ef7f2e1383

              SHA512

              06400450c3610a8c32936038b53349a5c86c5ed1e7279f5eac971f9147a5e5ee74e0f40b193928db664d01dd8d864b2f4999292c0bdd61bb66adb983a865775c

            • C:\Program Files\7-Zip\7z.exe

              Filesize

              1.7MB

              MD5

              c9ee9b04da814dc642b3056732271133

              SHA1

              7e83e6278da7b36f06e3ea60928d0e80e0c0458f

              SHA256

              4fabe3b15428cf42009fb7fc7f0c03fe46583c0e865e577ce7ec3b11876d1568

              SHA512

              e61e147cd7a673285e6c8d968aa36e562268e2f7b0630ab18dbfc9a1ca9857c1ad2c6344df58fd047893b585e364df3a2cab2e044277eccf154662bc14371a82

            • C:\Program Files\7-Zip\7zFM.exe

              Filesize

              1.5MB

              MD5

              198e894d065ce56569033886b8b4f5e3

              SHA1

              2abe19bec9cabf81f88615e6ebbe39f3f5fa2e45

              SHA256

              3e70b636b479950ee717d5c01ecc3cf47b2a500bd4198ee11d851e2e516c8e14

              SHA512

              9d0f1263d5359b2f0afa032a41cde3aeb207e9bbd7566a52db52f03ab8309780600490d46c10d6a3b6f498130980b408050e58db03143a6efcbee816e7e21185

            • C:\Program Files\7-Zip\7zG.exe

              Filesize

              1.2MB

              MD5

              ad700cad38dcf7b40b0a4a22bb0493f4

              SHA1

              6f02535ef2b32a840bcec1c6a0786fe43b30e22a

              SHA256

              905979d3a5b05956980f2c2f1de343e4b5e5c2d7dc4dbd422443ddc6d465c8f4

              SHA512

              052c34f4ab48f3c84d20a441d8270395812a252e683b37b0bf2c174833ee7e643acd4955fb02c6fa1bff109d44bd3d63fc4e9dc3eb2338a9695eb38ab2062f9c

            • C:\Program Files\7-Zip\Uninstall.exe

              Filesize

              1.2MB

              MD5

              c87cbaffe412795138bd64cb7376522e

              SHA1

              b0caa725f9fb2ae7c1633c041575839c067bd6f4

              SHA256

              f84727153a5e2c96abaf77eb0555bf050ae6be9564960825c02708eda0983186

              SHA512

              ac0bb81fd34a74fc6102fca0f13ad5937c31cd0f88ba9bdcd53f89a91e250181bc5c8ebbaaf9228995638672986cb15acf23f1c2324655d0661c670eaadf0753

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

              Filesize

              1.4MB

              MD5

              3ea8a67129f7035ab761d8070b998b54

              SHA1

              14d27bb33c75c3183d0312b001d6075e83d98219

              SHA256

              ab442e51c8450172b23fcc66324c90e168c641fec48092f4ec4bb51ddca82795

              SHA512

              58a757ea414ce888140c0e01379c750ca8044649b2447539a8e27ebd8bddfac5aceea067634049756ad15e0c03cddc12b2ec6dba8f3fde33ff43503896646294

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

              Filesize

              4.6MB

              MD5

              2e2dec7f247fe58b151a5644fe2d3bdc

              SHA1

              325dc7dea99c1ffc5df75b4051fb299b9600ac3c

              SHA256

              fb3a4e6a565013f3ed4c211386144442c37d14b5e446e46f7f6953af313d5982

              SHA512

              fcd114a3510713c548cb611ea5960d950a99237e79152c22da81062210ba683f07a63a1d8e4358b727541ab83a219a862f3d76502b117db819b7202c3e5b4b77

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

              Filesize

              1.5MB

              MD5

              150c5a2845139ceae4e961e5be9bc3f4

              SHA1

              e97820c9692993b735995270315e8c9e4c59781b

              SHA256

              8bf79173f84e8977c23c7680ab6195233b65355a3b2c0aa6e91ab5dad9766053

              SHA512

              ff7de8e37a473b8e1ce08c69f5b60e76b40152097a10a48a790580a0095ff8dbba44d2c9b19cf3c9b645700547a2a90d10848ef3461d4ee734643c70e594eb47

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

              Filesize

              24.0MB

              MD5

              4e341d7cb11af9fb06274d3dd65ca404

              SHA1

              b83eb2f9c48e6434c33d18c15f31a467a521271f

              SHA256

              b7801c49c911266003a203acf41e0ab1c0e6594c63171a339c52a853decd6d17

              SHA512

              6d3d07b766f8c39e3ff661889637317255fa9367cd878193f5b56aeaa87e34ffe5430f8471691ac0f3d97caf94b863402b6b8e169be3d2982b33a612231990bc

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

              Filesize

              2.7MB

              MD5

              751c1adb0a645f2ef5eb1b84d56b547c

              SHA1

              31dd9554da666b5314fb2e3f6d9351b9aa4d26b4

              SHA256

              4795f45bd0021d5efcaaf009c2b8211f998eba6e26665eb523a5e9a188990dba

              SHA512

              aae4c391a0d2611ecda14f3b3d071ccf419dcbbd6d7e5587a5872eeffafee86f7d673443d333d38b4ca2a4de3a8d76de13108529feae201a8d2e00856a06f623

            • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

              Filesize

              1.1MB

              MD5

              295459de72d35bfa1bea1d25d54990a2

              SHA1

              6b11b0c9fc36e816f479e395fd352de7e3b0c381

              SHA256

              008cb69e3e90111399c91a1daf7e921dbd5a3f765309f66261a737a5304cca45

              SHA512

              6f93baac9473b71879c8e7548299e726810c8a882f00b8f497b19c4b773629d0ccc37f18ad2118828ac134c0723a0451d48ee7fc0d1bdd92d82c794c92b23de8

            • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

              Filesize

              1.4MB

              MD5

              30dc923cbd51e47d0412968ed6cf59c5

              SHA1

              93a4b26fc957ca18a20efb62f5f3967effd5a594

              SHA256

              15b1ee7a610f708751c6565b8ba7d447e6323591b24f2335f9bc20748d028896

              SHA512

              a01ecb02e75af2196d851751ae619e9d452483b1f077008bafd88253d126eacc84c9eb865a5c475158a3a42eeaa04c125cbbaf8e7674afd5db80a0a4fe9866c7

            • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

              Filesize

              1.3MB

              MD5

              792b1edf0af79e7756cc396b89afe6a8

              SHA1

              3779c90fe4680649b0050ffa546f284fdf3dd094

              SHA256

              029b63a7542709d6e10dd53416394d4680a90f6641bd0abf61b15e6190b05e61

              SHA512

              a17c343b79ffbb23d7530952d577377b066bc693e9a0b7273025e63cc12e5d0623a917adec2ba079282badec23153459fbedca09cabcc18ff9f24d97e80c17a8

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

              Filesize

              5.4MB

              MD5

              ab4910e34ae6c62b798144cc588f6f79

              SHA1

              d2f4d2d6bf64e537de3304a45992a0a56c99b70b

              SHA256

              2c94ede0f1d6ae4da94150459e0102dfb0fc685e64326d2129d5c32c639334de

              SHA512

              50dc375b830dc88d6df2b71a49db166c46aa840d3b0cc7f72bc5d5bb1c8e5ef3c2bf787524db70e27a79333eb5963ebeeef69b9da6a8261ec5ee92d360972040

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

              Filesize

              5.4MB

              MD5

              a10dae099e511ab80c38dc0acf616240

              SHA1

              b65e6c2d249f878a2e497a8383b825ef177eccca

              SHA256

              4d37f6f5b26c54d840d52b3e5991529f63a82dbaf9ea738c2beb85628707366f

              SHA512

              d924396a1b9f9a114e5ebad617ed8d36e72bad97a572ea14c1dc452840d65806e761dc222915a0c530939ab4174aa5cc7eda0dd4c1556e603a9e4a25362313ae

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

              Filesize

              2.0MB

              MD5

              bee30543ca2050e12209b793524354b9

              SHA1

              ed413f1690796401e4e8d33b2ef159cece22012f

              SHA256

              3a9d93f79badcb745cf284f7d2e3c410c285fdfdf8bb9ad7c6a7b6655cd9b647

              SHA512

              c9ec62fe03f059b758a9b7a40fb4052612c82ea61d25d830ef7e7ea3568fc1357b713bed092fc57efeb0d8d8fc38faa7ba36adda0d48531e426ad1bf32a25662

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

              Filesize

              2.2MB

              MD5

              16311ec86f13f090af630bafc134540e

              SHA1

              48d595ab058cf1c616b4d00dc8c2b15816fc70e0

              SHA256

              d5264f58f2cd4b000acb947209e5c4bbc958e59504a6ff311231ddd292e2a9b5

              SHA512

              c7e5c7c69f7455b3570c67162b97f177c0e985387b14882c91ef67406e461a67debe3c85f26f2c388c2903623fd63a4e4180ff3a3a116ce771a68992998e67d0

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

              Filesize

              1.8MB

              MD5

              ff738bfd4111d50d5cdab637bd75c4fa

              SHA1

              df1c67fbe01ff649016d4768390cecbb00aab1a9

              SHA256

              05531eeb492f08e778fad4dfe8f299b6e9b499a1be3cd77985339c5fd58a74a3

              SHA512

              1a7efd719533fa834865f3441548492ab3ce7739597c37d084261b767c673cc7dcf2162caea6160d3b4bf7028b146719f481d3fe25ca8a4ce21c5de59ef51db8

            • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

              Filesize

              1.7MB

              MD5

              268d8191a2288620b8eadcdb74424ef5

              SHA1

              ebef306527a0c05e66e8b4bd54d6be160f16563e

              SHA256

              b545694cf5ac57c663b4e4592a805989f2a20a459813315691b2dc006900a9fd

              SHA512

              fc2283a881c2388641f568ba364eb31fd339c75425935326c4209877b1f5f3199365f5b49cc51791e581b15bf3d74dad4169e07ac59988a30ca51f5a69afd5c6

            • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

              Filesize

              1.2MB

              MD5

              e6ec83640b62aa355e70c59652c3730c

              SHA1

              364c1c16563f18366d8eef95c2b824ad5ddb9cca

              SHA256

              601cc63cc695d7e2f1d650d78435e638fe1558e082bd37a5209439415a033a49

              SHA512

              a5e27814505321abfb798b385260dac645385dc5a73d96053be37747cee22a4d2a171d2f3eb65be050fb6c65560e9d2a1637678c8568cd9475596370d257b336

            • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

              Filesize

              1.2MB

              MD5

              2cdf708ded461a0081095d8f560d363c

              SHA1

              4e94fb284d24562708986398aca3c4062fa5a8c8

              SHA256

              7e951306ded9a129c72cb08e81e695073fd27322851e56e3e2efa45b8855ddf6

              SHA512

              38a77f4eccc5de32190a3f55123712b2802359c0b9de758d7e9f146a6b2007dc295aa602192e3f0f6bc1239e467accc72b5278b342dcefbe8be39ef5273a9a90

            • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

              Filesize

              1.2MB

              MD5

              d9cb94ca7112543bf035b27c5b2f9252

              SHA1

              19dd2dd120c1c76566b1b7f32c9d43fe75fb6ea8

              SHA256

              86396ce4246311114bc9ffcf4e46f090aae998ea409e2398e06075d3bfae3194

              SHA512

              d246b11c95932f1d22b3e778e560b560f3a79d35bc5717f216d38f4dfbdff775e458b27fcfc3a6ff33d62123a1f2ff47f344b61806091bf68d7394933dec5249

            • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

              Filesize

              1.2MB

              MD5

              768c1ef00813ab7f52133e6180b3b808

              SHA1

              d1c64bcf6ed642880367215acc905e30c4116d9e

              SHA256

              caa65f3511c95442aa407f6fed1fa5f00a2d746a9840a456750b221e05b6be33

              SHA512

              ba259d7b51dde59dde00a5c0582e4ecdc1e809379d02114ef7a6fc65227f6ee54bee63d5e57c85f6a521bb660e908f44f24e7c769e0de36276b7c03373ffc793

            • C:\Program Files\Java\jdk-1.8\bin\jar.exe

              Filesize

              1.2MB

              MD5

              37675b0ea7579bf10d0b3cb8cd881da1

              SHA1

              a2d8e796819c13e8af46dcc7f13795a4f551b7db

              SHA256

              49fbd5c6aefa12071d20c13d5755fd915c7cab98d37de953b125a1110e67d2c6

              SHA512

              e93dd52b21352c607ff53145b9fbf390a2f467aa2ac69db56e343bc7ca462c71de4f65bb10771eff5b50538b157d7ae7936f77ffe82a0bbf98c5e26316be6ef5

            • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

              Filesize

              1.2MB

              MD5

              610e74602d0b90d4aa19a8c8da846c5d

              SHA1

              dcef702ec3eb6084d8eb7ccf9378a4a1e54dfe98

              SHA256

              b8b49ebb8add18636134b3ead26f9b76f1fca06c112546ca4bc192c402eb1fa7

              SHA512

              5a82b50296e2e9fb9be2f2edfe112a576ba69b6956d2b307d6d3c7eed03a0eea11710ef08bcb7f97de2eaa83ad6dabac373ff09574427c745a69d1fb12eabb94

            • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

              Filesize

              1.2MB

              MD5

              5bc30df2b7297085c3258107da080b18

              SHA1

              85de5f1d0d69ecc2c042ad06f1cef39363d028fd

              SHA256

              7a2a62da308f653d317f70db1c327f4a380a54b3b8d5a9894d349632d292ef0c

              SHA512

              8f52585bc4b5ec899646a7282440d9e4225849b11c9f1751de2055b6b06969513ec6a2c96ad3c38a679675340e5d7695640cf757a8a9451dbb5aa94f99243990

            • C:\Program Files\Java\jdk-1.8\bin\java.exe

              Filesize

              1.5MB

              MD5

              919448b7040c66e36142871e04c72cc8

              SHA1

              38ca186487f0f2d9ae33d4fea8df7d72caceb069

              SHA256

              9e63e9b7749c3fb88d2c3761761a2860b44261b5a4de34f8b699e663e18c81ac

              SHA512

              f68a77c5b4b5dbd6cb09328c4ba1728dcbc23095c1a9307be45be511fa30f39c89a04feeefa5bb7cd1f0a48cc1fc7672d8c52954fc0632034f36ece42323f303

            • C:\Program Files\Java\jdk-1.8\bin\javac.exe

              Filesize

              1.2MB

              MD5

              7ec0d7aae5cd349d0b144a50c978965d

              SHA1

              59ddf27b84117618b102c8dda62c66719b141bd0

              SHA256

              f4b38ad43f7397d69eaf60fdc366bf5a63c7c3c38d38637c2f5eade675d249bf

              SHA512

              417a1b4e3a074f61f62df2bdb1f85b8f166eb12597c815d0ae59ea66c12b32a3a2acca367ebfe57b4d5fee45f1b1b5f63a065ca6bb9c1df86ec4303195d13f5a

            • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

              Filesize

              1.2MB

              MD5

              dd951c5769a6f305fce3ec403c51db40

              SHA1

              464ba03023ee5a7f1ecf09e95e6d3368c2907ac5

              SHA256

              bd689e348530675f73b4e27a2eebd4a591a2fb047b3ad528611dad7a147799f7

              SHA512

              50b6a00c4bd927f2b484bc33d82b8297b66f98a1bcfcc73d0039bf6a3de70efd9bbd53003ee4a98a3b9af0fe702a1658e659d7180b3d66aa622ad2cf023d5ba4

            • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

              Filesize

              1.3MB

              MD5

              0ba3cff844be28830109d774ad615886

              SHA1

              f4bb42da570561cf4c53bd041532bada28f3bea3

              SHA256

              0aa5ff4cde0c3c9c869eb1caad14b1632ddd7dbba351e9339bc90b6dc0159c3c

              SHA512

              4d1454bd0e322e073ae05f5cfab4c3a1527170117a9d48612864574260d57833f35e2307ac34a21ec5680c7763c3e766a4a4588a924a598263a5807f0e1bf06a

            • C:\Program Files\Java\jdk-1.8\bin\javah.exe

              Filesize

              1.2MB

              MD5

              6d8b70723ed557286a0483f595da577d

              SHA1

              926ce58d8a2602175b986e7487d648dd7af3c316

              SHA256

              553c559dc57c375c363bb72505bf4709abc70c158ab276990f0e8c1ff8ae95c3

              SHA512

              51a5740d6128d5e484050425c4a9ddad1b50a3c5fa021747ccc82aa2897ecc6be591a597a8b3f3cf89d758ce25bd874da7f9c2a91e47a185b9f90d025f2006ba

            • C:\Program Files\Java\jdk-1.8\bin\javap.exe

              Filesize

              1.2MB

              MD5

              330bcceb8863533c4154b84da20c5b90

              SHA1

              186a57ab5b18dd14ed8d16f0c949fc1aa3c6f3b6

              SHA256

              e42832b27c7343dc7be63b5276972f4cd261976451b2edc707e45bd385711b44

              SHA512

              53533827960280a6c3ef0dceb4ed775edeeeeec36aac9b9e69d3f5a2d3ff9c2c6de7dd4f2e2e195ddc32811494a9733ee5abba48d117780c1d7f682a9dbaa8f8

            • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

              Filesize

              1.3MB

              MD5

              92f13c3124bb716ad81bfe500a5409d8

              SHA1

              59e0b178b3be6ab9217e4f28aabf6d1040a97a29

              SHA256

              528952d2a40dffb7d2e7bf9fd5f1805964744ab934f85a395359c3e4ae0a5411

              SHA512

              13348291880e7e3065365ecede577110ea80978398ad2a7d653dff642797e13eac00cb384671abc2569af8fc8598ff83743b0fae16e554b0ca1b65cd1a3f6f91

            • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

              Filesize

              1.5MB

              MD5

              96077f18c1279e511b241a85dc3aba13

              SHA1

              bed0fe32faa88536e830b2122ad02e455d1ffa15

              SHA256

              58b004b1263bb6ff718d9f05756d2a5e4d7c7439c545dd8d6bd9358a97161ede

              SHA512

              249a469c7129cbec5bf048e4eb8170615a031636a93921c905bc57929f8c5a0931b00cb4b167aa40e89ec3ee5278ad4e81a04af402136da6d4986971168cfed1

            • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

              Filesize

              1.6MB

              MD5

              f945ad648d95dad32cf0c0d6c0928e98

              SHA1

              b36066253390343dd24f3c901521162b2a34de7d

              SHA256

              7ba5cc1ba8492bb9e1b9d550754d121cae90218a04ebc0542b93a6f55afbc40f

              SHA512

              4e78500d917d2a14a060eb60f6c5854d39bda0217240665d4e4ba27cf978fa30c4e3b6fc84cda95d3854cf2fb50d9a97f525e0e2b715f5dce181f85ee946b721

            • C:\Program Files\Windows Media Player\wmpnetwk.exe

              Filesize

              1.5MB

              MD5

              6885b52f195eec4fa3e4c74b24dc09d0

              SHA1

              ef8ca0fa47c7154a642b0e8ed25c1125b115f87d

              SHA256

              cab58305360d67e6540ff90e5faccc3a791c2a0d907d8848d75c5ef4c2bd1649

              SHA512

              6196bdbd623cfd22000ea62a8e23d22335222e153d01bc680d0de1859889dc21d38964f28e0bb369752931206e1f3038ecce262c246fff536b7510986fedf1fd

            • C:\Program Files\dotnet\dotnet.exe

              Filesize

              1.3MB

              MD5

              c45185222a499b7ad5d2da8b4cc160c1

              SHA1

              8ab710fb1b4ebebc01fa3d08b3f679e452522c62

              SHA256

              2687930990881f083d106564c5dcff317e8f891d8dda23f5abefd62393026fb4

              SHA512

              f446500e1059ca5ce50f6a8762b7b2fe6575ac70948b2fa420aaf64c18b5d0a8f36acf9622577f19c732fb9e2a648f1a9d376d33641a0dda2dc6d70e02a3c9ee

            • C:\Windows\SysWOW64\perfhost.exe

              Filesize

              1.2MB

              MD5

              44ffecea0dc3d69383f007570287d651

              SHA1

              2e265eb8b504e0d6e6d617a171fd2ce4d1271c0e

              SHA256

              fbe0d271593e8a046230783342497dbb872ed2e082d5e20eb7bc8d87b55c8cd8

              SHA512

              9b9135cd4d5f83cbe0a46856c29952790d94752dcbe12c6d4c5bf1f90f8ad5821ffa132374dfb334c656a76e93665a2c83ae373b12a03b58d42706dbdda8bd0c

            • C:\Windows\System32\AgentService.exe

              Filesize

              1.7MB

              MD5

              3b32d66f142b88892c4d56bc6a004f42

              SHA1

              8dac6ab8142e79ac061304ca8aafd3f38fee039e

              SHA256

              3e5e8de4d89ea6a6fdcf2d69ac924fdb7ee483e53de565386ff8aeb09341b888

              SHA512

              949a7eaacd526ce19504cb3fb4bcb57baa8c27e4fa383b56aca0c5f4c99e642b1ee5746cd4a58932338dcbae37183994e8a1d9e6438426a265651b1851648ff2

            • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

              Filesize

              1.3MB

              MD5

              eaa7b02960f9ceab29f754df1549bd8f

              SHA1

              ec771095c7a7b410f448acfe306957af852c3cad

              SHA256

              c7048d8b44dcd2dff43cba1c863befca0f33ed40c742bf863c46280d562ccdda

              SHA512

              7267ad6e2341fceee7ca9a0bccfca22bc7621432c5b2c087a1c161231a517c89779de94cee12036fcc6c69aba072def883b475a5323769a325b226e2d3b68c07

            • C:\Windows\System32\FXSSVC.exe

              Filesize

              1.2MB

              MD5

              21b274cea3e30291cc96855fd2ff67df

              SHA1

              ed4f90dff65aeefe0efa1339be675acd8f539ea4

              SHA256

              a58aeb50f1fb58afd18d30537acf86b2e349b09a47ede9328bbbae0bb10035d0

              SHA512

              06cfc274f5b577d3aef91718221967e68105fbc5b19ff694f8c7c912d0649bf6d2c8e6918e0a9ea12c79c596e497bbbad8cceda5c95da582e9e96affaa6dcce1

            • C:\Windows\System32\Locator.exe

              Filesize

              1.2MB

              MD5

              96a64b6920ed10bf3bf724f1e495074f

              SHA1

              6a989e4b45ea4e5d1da0867ec3b6ecaff28b7497

              SHA256

              6918a7a071bf6e988228305d4bc01f150b652bcf7b26593432845c32d8886c17

              SHA512

              90544ce3722681aa306fede3e42f3eb746a303ceffb0b78dfa90baca62a10d03955645e084a831123b30a39b2edea3a7d83ee82a1b1f2fcf8bee52cd17c138a0

            • C:\Windows\System32\OpenSSH\ssh-agent.exe

              Filesize

              1.5MB

              MD5

              4b6817e51b93ca295e2cd3f3d8856b4d

              SHA1

              015d4bf793f938f7349d70af2c0fd6153cf463bf

              SHA256

              d7080e92ff5218f2eea16676441db8792f3fa6b409f54504a1ff19cefcca56d5

              SHA512

              027a9e04b95fa3d74bffe52b7ce35ee21c2d853962a6473a44be417f9e39951be36f72c0ef69c9dbb1eb89f74377e701f5a98eb5ca35ee2844677d720ac62b70

            • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

              Filesize

              1.3MB

              MD5

              69ad9cd6e264e725fee3a0ae85cb2184

              SHA1

              5da229eba91ae5c0648aa630b7c4ea83fbc7ab4d

              SHA256

              cbe255a5572998056ddefd9da8462af6e8cf0483f8d4e9f42ec779739b524367

              SHA512

              56581a49aa22a9853cc1170aa18ae58c5e4ce9511da7978e88ee01c8b62013131ae824491994ea5bcf7e42113b92fbd135fbfb7d47be0e58c9b412eee5492c69

            • C:\Windows\System32\SearchIndexer.exe

              Filesize

              1.4MB

              MD5

              5188c3cef6fb48cea572214f7bfae4c7

              SHA1

              772cd403d7ba6c04505aeea65df62667c1eb2a6d

              SHA256

              423b5c85d0403844b210932a57caea4d6f17cfa89170723c5e2e78a3abe232ed

              SHA512

              fc1f808b49752e8700e03e5ad2fcecf77471fff9dba93c5c64773e2c8c13a437970418d59b6af14dd7f5bb344edc3a05942ba610792667e6247026f59f04f69d

            • C:\Windows\System32\SensorDataService.exe

              Filesize

              1.8MB

              MD5

              67112eadfb5853fbd864ed1f956ec6d0

              SHA1

              a8619d1022f23e4428d78bf6b96549a5706aef45

              SHA256

              a90111109bc1f6ff8f102dcd025db20c838c0b4dd907d7ffb657cb73a421c6a4

              SHA512

              4b6de656519b9fe246acbff416e5208cbdbbb277a611305976fc643836df8a8f9dd7be43bc77b922d42c0d3b77a8f3b8c0d995b7dbcf94ca98b84e40b9a803ec

            • C:\Windows\System32\Spectrum.exe

              Filesize

              1.4MB

              MD5

              29dd6b18a0efc7737ee7d1cc91ec9410

              SHA1

              a9b625b7c791b0bff8d8a2e6df886f7d4daa3787

              SHA256

              80e2a529640c2417a3ae925fe940dbb09931d2f8ea76a55b2a9f6e9527490325

              SHA512

              123099720f9647ee9de347431bade49620e0b36a589beaf2cdaf581980c6aff8e09ab3eba0f14731da7b8c5c4f40cb0d9998467c6cff67cf88943c5fb139a4cc

            • C:\Windows\System32\TieringEngineService.exe

              Filesize

              1.5MB

              MD5

              9d3a8e7a6929c8a2753fd2db5ed814a5

              SHA1

              a95c681ec18fcdca166b3daf54bc72929536ea19

              SHA256

              cc7cb10a2acc0d464ab2b2693c91ed1e2a7f97a8dc7c528aa799b6ff6d87557d

              SHA512

              1773a430eb09d9bbb04ff8d04246bea3f6e7c5685342d1edd3525583fddb06cb7b334e2d7725da9889254e69c78ee98ac9b5e3411738d7214c507e12aaaa2b6d

            • C:\Windows\System32\VSSVC.exe

              Filesize

              2.0MB

              MD5

              8b7a158cc37241eeac8b022b793652f2

              SHA1

              81b2703ae8aeba13a3040f9f2a2927e38a94439e

              SHA256

              1d0ee4523d29390f7f1481c8eabec0088984df1c141b88f1a7e117dfb8f34d83

              SHA512

              81029c0e6c1dd0bb29076dafaa564bef4fdae95be1a3fcd201bfabbd2c3bf54329ee74d2f8c33b7d5f7c263ddc525c2e0cdcbad5288b590cdc5e0675a3e5e5a8

            • C:\Windows\System32\alg.exe

              Filesize

              1.3MB

              MD5

              6f759ee0d83f949b86d29b1a5b0f923b

              SHA1

              dde745cd6ee34444b57b32d9250ec9a037a4056e

              SHA256

              a666f47f8cf9ae66c55e951011c4aabba5b6d5102b61fab838059b58ce32aec1

              SHA512

              8d2545517dca76c7de5b9eff5309c3fee11916f379b626d27b6e752264e17df0389b8b7e6276decd03087844c60db71bbcc04c8f4c4c4f8b0a6e36cad8976d5a

            • C:\Windows\System32\msdtc.exe

              Filesize

              1.3MB

              MD5

              0b70f2f85aa902b664aa30b0fc2bb39a

              SHA1

              1e1b561354508a3759bd2a377daed77876753bfc

              SHA256

              4be51c3566ce1b664db0be6c13fcd224b5c25a0b28f362277ea7ebd5d1053f46

              SHA512

              b45a6d6da463a15978ae09819036fdf0ca7d7e039359b921ff8b47aecf3ddff9c62739bc54ef058f4e795cdd01cab35dc24a06a094731ca0cd4718527385265e

            • C:\Windows\System32\snmptrap.exe

              Filesize

              1.2MB

              MD5

              917a02926382d1fa69c5d5845b735763

              SHA1

              acaeef4d96dbc09398b7262db71ae65fb012a479

              SHA256

              4ad34d83943ae05f0ed0c3a590ffef3ac2f63f341f2471596d626d9614189e08

              SHA512

              c63df84020b2efeb7a3ec03b6185d79ad29c6f40364de5f55e86aec165f110f3c7c834a8804e0b8fa2023d393f731b7eee57941343994aaf1e3de84ddb2227d4

            • C:\Windows\System32\vds.exe

              Filesize

              1.3MB

              MD5

              06700d16ad5ef065c53021a7a8f1d3b5

              SHA1

              4e9c8c3bf6783907165f839f17e95633ec2ecb7c

              SHA256

              007823f43ebcf30f7b7758bb27ae3e7b6503db23d5764266c6607fc8ba1dd289

              SHA512

              21372056e5b188ab76234840b77d952a07279670811b4d7158993ee01f5ad3ec2cdb91dab4185e267373bdca843163f3bc9ad9f5068afc598c97081d4423aa9a

            • C:\Windows\System32\wbem\WmiApSrv.exe

              Filesize

              1.4MB

              MD5

              a4ac152d9259c217c442a779ba84ff1e

              SHA1

              991436544317536b3444630966ce0f664ef00442

              SHA256

              e7e25a397910b0bf31d44f722634fd9a4365409bee41c854eedf1937953172fc

              SHA512

              2aade7866c779bb2acab0727d31cfab838e0c947a57459b747aa9ca6df01058b929b25283615d80e8e247a2a1ac11d1603906ab12f8fa27606bd180690bf30ee

            • C:\Windows\System32\wbengine.exe

              Filesize

              2.1MB

              MD5

              32954babe396c0023f98a3dd030d2017

              SHA1

              c6eb44135572b97ca50b469a6536cb9a1f3e3d96

              SHA256

              1333331c8f9f6051c048666ec5fca680f108e82ef349dcdf7cb11235f97e2c57

              SHA512

              f977ff6855a6f3d84b5a568e161a3d741f061bb3b487377675a85c092ffeb9512d0d83cb657e9b93ecc787e75d267728d97d2d6416762780f2f696e551a82ca4

            • C:\Windows\system32\AppVClient.exe

              Filesize

              1.3MB

              MD5

              194aa7a9bdb59059bc4d57dff1dd2e19

              SHA1

              214a27825837764435113b9e4f145202e67eecb5

              SHA256

              51b990a2b27d6711b612858a571ae85fa38dc6ab1230c2d8a3fdca32f371385c

              SHA512

              539a00151ea45049b7aff5e1426799f4b1930dfd135e3ac4446dbd14e4138ba971f00a5310ac3bac9910f0a08638913d0e40f6fec4ffff7e1ce72845459d50a4

            • C:\Windows\system32\SgrmBroker.exe

              Filesize

              1.5MB

              MD5

              8efccb1bc8ba3f0e91c6c6393f2e2f74

              SHA1

              234a0141c0d7bfbcca9fac08b4420d0926a30dd1

              SHA256

              2eb99bdd0ee66e0d72282b39c26c56b7afb82fa4ee855af00c72d98562a4d991

              SHA512

              1bdacf6fb16ed6ba34c13800275b49b41ec1c4d64d551bb62807571adfb68b2c7c79999786ae599d5121d3ad1d311c4760b3647dd1890dafdd1de7e8ddd02892

            • C:\Windows\system32\msiexec.exe

              Filesize

              1.2MB

              MD5

              82e994f55769a9f3b61cded761e0cba3

              SHA1

              4b16cb819dbe55a845f0d8de21d87394d08158ca

              SHA256

              ce49d8b6ae11696722905de250b43a2e6f6061928cd91a81be77a53bffb3aef6

              SHA512

              5a937f6704dcbc877312aba5c283a08615009eee0725c13fc2add4b9a62c60179b1c0ede474332c94d9daea4861c55a52ee7325c65502fee45e372ab7fd90c87

            • memory/208-163-0x0000000140000000-0x0000000140167000-memory.dmp

              Filesize

              1.4MB

            • memory/208-385-0x0000000140000000-0x0000000140167000-memory.dmp

              Filesize

              1.4MB

            • memory/396-159-0x0000000140000000-0x0000000140183000-memory.dmp

              Filesize

              1.5MB

            • memory/464-158-0x0000000140000000-0x00000001401A3000-memory.dmp

              Filesize

              1.6MB

            • memory/468-61-0x0000000001AB0000-0x0000000001B10000-memory.dmp

              Filesize

              384KB

            • memory/468-55-0x0000000001AB0000-0x0000000001B10000-memory.dmp

              Filesize

              384KB

            • memory/468-64-0x0000000140000000-0x0000000140170000-memory.dmp

              Filesize

              1.4MB

            • memory/468-72-0x0000000140000000-0x0000000140170000-memory.dmp

              Filesize

              1.4MB

            • memory/468-70-0x0000000001AB0000-0x0000000001B10000-memory.dmp

              Filesize

              384KB

            • memory/540-30-0x0000000140000000-0x0000000140135000-memory.dmp

              Filesize

              1.2MB

            • memory/540-42-0x0000000140000000-0x0000000140135000-memory.dmp

              Filesize

              1.2MB

            • memory/1296-69-0x0000000140000000-0x000000014015A000-memory.dmp

              Filesize

              1.4MB

            • memory/1672-162-0x0000000140000000-0x0000000140216000-memory.dmp

              Filesize

              2.1MB

            • memory/2244-154-0x0000000140000000-0x0000000140136000-memory.dmp

              Filesize

              1.2MB

            • memory/2348-156-0x0000000140000000-0x0000000140137000-memory.dmp

              Filesize

              1.2MB

            • memory/2368-332-0x0000000140000000-0x000000014014B000-memory.dmp

              Filesize

              1.3MB

            • memory/2368-12-0x0000000140000000-0x000000014014B000-memory.dmp

              Filesize

              1.3MB

            • memory/2672-386-0x0000000140000000-0x0000000140179000-memory.dmp

              Filesize

              1.5MB

            • memory/2672-164-0x0000000140000000-0x0000000140179000-memory.dmp

              Filesize

              1.5MB

            • memory/2748-353-0x0000000140000000-0x00000001401D7000-memory.dmp

              Filesize

              1.8MB

            • memory/2748-155-0x0000000140000000-0x00000001401D7000-memory.dmp

              Filesize

              1.8MB

            • memory/2772-137-0x0000000140000000-0x00000001401C0000-memory.dmp

              Filesize

              1.8MB

            • memory/3444-25-0x0000000000690000-0x00000000006F0000-memory.dmp

              Filesize

              384KB

            • memory/3444-24-0x0000000140000000-0x000000014014A000-memory.dmp

              Filesize

              1.3MB

            • memory/3444-16-0x0000000000690000-0x00000000006F0000-memory.dmp

              Filesize

              384KB

            • memory/3548-7-0x0000000000AE0000-0x0000000000B47000-memory.dmp

              Filesize

              412KB

            • memory/3548-165-0x0000000000400000-0x0000000000625000-memory.dmp

              Filesize

              2.1MB

            • memory/3548-6-0x0000000000AE0000-0x0000000000B47000-memory.dmp

              Filesize

              412KB

            • memory/3548-0-0x0000000000400000-0x0000000000625000-memory.dmp

              Filesize

              2.1MB

            • memory/3548-1-0x0000000000AE0000-0x0000000000B47000-memory.dmp

              Filesize

              412KB

            • memory/3564-379-0x0000000140000000-0x000000014024B000-memory.dmp

              Filesize

              2.3MB

            • memory/3564-38-0x0000000000C90000-0x0000000000CF0000-memory.dmp

              Filesize

              384KB

            • memory/3564-40-0x0000000140000000-0x000000014024B000-memory.dmp

              Filesize

              2.3MB

            • memory/3564-32-0x0000000000C90000-0x0000000000CF0000-memory.dmp

              Filesize

              384KB

            • memory/3896-381-0x0000000140000000-0x0000000140170000-memory.dmp

              Filesize

              1.4MB

            • memory/3896-74-0x0000000000510000-0x0000000000570000-memory.dmp

              Filesize

              384KB

            • memory/3896-80-0x0000000000510000-0x0000000000570000-memory.dmp

              Filesize

              384KB

            • memory/3896-151-0x0000000140000000-0x0000000140170000-memory.dmp

              Filesize

              1.4MB

            • memory/4500-157-0x0000000140000000-0x0000000140169000-memory.dmp

              Filesize

              1.4MB

            • memory/4520-166-0x0000000140000000-0x000000014014C000-memory.dmp

              Filesize

              1.3MB

            • memory/4520-90-0x0000000000B80000-0x0000000000BE0000-memory.dmp

              Filesize

              384KB

            • memory/4520-84-0x0000000000B80000-0x0000000000BE0000-memory.dmp

              Filesize

              384KB

            • memory/4660-160-0x0000000140000000-0x0000000140147000-memory.dmp

              Filesize

              1.3MB

            • memory/4672-52-0x0000000140000000-0x000000014022B000-memory.dmp

              Filesize

              2.2MB

            • memory/4672-50-0x00000000001A0000-0x0000000000200000-memory.dmp

              Filesize

              384KB

            • memory/4672-380-0x0000000140000000-0x000000014022B000-memory.dmp

              Filesize

              2.2MB

            • memory/4672-44-0x00000000001A0000-0x0000000000200000-memory.dmp

              Filesize

              384KB

            • memory/4708-161-0x0000000140000000-0x00000001401FC000-memory.dmp

              Filesize

              2.0MB

            • memory/4708-384-0x0000000140000000-0x00000001401FC000-memory.dmp

              Filesize

              2.0MB

            • memory/4924-152-0x0000000000400000-0x0000000000538000-memory.dmp

              Filesize

              1.2MB

            • memory/4924-99-0x0000000000760000-0x00000000007C7000-memory.dmp

              Filesize

              412KB

            • memory/4924-94-0x0000000000760000-0x00000000007C7000-memory.dmp

              Filesize

              412KB